hats-finance / Convergence-Finance---IBO-0x0e410e7af8e70fc5bffcdbfbdf1673ee7b3d0777

IBO, Vesting & Bond mecanism repo prepared for Hat finance audit competition
0 stars 0 forks source link

Price is computed incorrectly for curve tripool tokens #78

Open hats-bug-reporter[bot] opened 1 year ago

hats-bug-reporter[bot] commented 1 year ago

Github username: @justefg Submission hash (on-chain): 0x2b04b4bdabd8811a4a59de320708018cb716d18bfc19181d095dc5e4765fda80 Severity: low

Description: Description\ Consider a pool USDT-WBTC-ETH https://curve.fi/#/ethereum/pools/tricrypto2/deposit

When calculating price for WBTC and ETH isReversed should be false for both of them since base token is USDT. However, this doesn't work and the parameter should be set to true for WBTC for correct value to be fetched.

Attack Scenario\

Attachments

  1. Proof of Concept (PoC) File https://gist.github.com/justefg/c4c341866aea0c2ad36cafb7aae025be
    
      {
        address: TOKENS.WETH.address,
        name: "ethereum",
        poolAddress: "0xd51a44d3fae010294c616388b506acda1bfaae46", // USDT-WBTC-ETH
        poolType: CURVE_TRIPOOL,
        isReversed: false,
        isEthPriceRelated: false,
        isStable: false,
      },
      {
        address: wbtc,
        name: "bitcoin",
        poolAddress: "0xd51a44d3fae010294c616388b506acda1bfaae46", // USDT-WBTC-ETH
        poolType: CURVE_TRIPOOL,
        isReversed: false,
        isEthPriceRelated: false,
        isStable: false,
      },

This fails to calculate the price for bitcoin correctly. Now, this is very easy to fix by flipping `isReversed` to true. This is very hacky and prone to errors though. 

2. **Revised Code File (Optional)**

I recommend not using `isReversed` for tripools and adding another option like `triPoolIndex` to avoid possible mistakes.
0xR3vert commented 1 year ago

Hello, Thanks a lot for your attention. We are using "isReversed" for all the type pools to save gas on parameters, so it's a normal behaviour. Also, we test our parameters before deployment to see if the price is computed correctly. If a wrong computation occurs even if we have deployed the bond, we can change the parameters to correct the shoot, so it's not a real problem. In conclusion we have so to consider this issue as invalid.